'Goner' worm hits PCs, attacks anti-virus software

10.10 am

SAN FRANCISCO/LONDON - A new computer worm named "Goner" is spreading quickly through corporate and personal e-mail inboxes, deleting system files and clogging networks in what could be the biggest outbreak since last year's "Love Letter" virus, security software vendors say.

"Goner is one of the most incredibly fast moving and potentially dangerous e-mail viruses we've seen," said Mark Sunner, chief technology officer of MessageLabs Inc.

People using e-mail, ICQ instant messenger and internet Relay Chat are susceptible to damage caused by the worm.

The Goner worm arrives in an attachment masquerading as a screensaver, with an e-mail subject line of "Hi" and text that says: "How are you? When I saw this screen saver, I immediately thought about you I am in a harry (sic), I promise you will love it!"

Once the attachment is clicked, the worm tries to close programs that are running and deletes certain system files, including security software, said Ian Hameroff, business manager of security solutions at Computer Associates International.

If the PC is running Microsoft Outlook or Outlook Express e-mail software, the worm also sends itself to everyone in the e-mail address book.

Goner also tries to install a denial of service script on machines of IRC users, said Symantec Corp. That could turn PCs into launch pads for denial of service attacks, which malicious hackers use to flood web servers with traffic from multiple PCs, effectively shutting down internet sites to legitimate traffic.

"This is at outbreak status, which is very rare," said April Goostree, virus research manager at McAfee.com. "The last outbreak we had was 'Love Letter' in May 2000."

A virus is given outbreak status by McAfee.com if it is determined to be spreading quickly and affecting large corporate networks as well as individual computer users, Goostree said.

One of the nastier aspects of the virus is its attempt to disable antivirus and firewall software, so that victims have to reinstall the software in order to prevent future infections, said Sunner of MessageLabs.

UK-based e-mail security outsourcer MessageLabs Inc. said it was receiving more than 100 copies of the worm a minute, totalling about 23,000 worldwide since early Tuesday morning, with users in 17 countries hit.

Anti-virus software firm Trend Micro Inc. said it had recorded infections in 17,000 work stations and 30,000 corporate e-mail accounts across Europe, primarily in France, Germany and the United Kingdom.

The first report came from a French company on Tuesday afternoon, said Raimund Genes, Trend Micro's European vice president of sales. The firm has issued a "high risk" warning on Goner, the same rating it assigned this summer's virulent Code Red worm

"I expect by tomorrow morning we will see something in Asia, and then from Asia, we'll see re-infections in Europe," Genes said.

The origin of the worm remained unclear. Trend Micro and McAfee.com said they suspect it originated in France. But Mikko Hypponen, manager of anti-virus research for Finland-based F-Secure, said he had his doubts, as the first recorded infections came from the United States and South Africa.

Hypponen also said he thought it suspicious that some of the victims were ICQ instant messenger and internet Relay Chat users. "It's most likely written by a teenager targeting other teenagers," he said.

McAfee virus information library

Trend Micro virus information centre

Symantec security updates